AI-102 Plan and manage an Azure AI solution Practice Test 19 — 15 Questions

Question 1

You are deploying an Azure AI solution that uses Azure OpenAI Service and Azure AI Language. The solution must ensure that each service has its own managed identity and that access to keys is restricted. You need to configure authentication for the services. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable managed identities for each Azure AI service and grant them access to Azure Key Vault.. Managed identities provide an identity for the service in Microsoft Entra ID, allowing it to authenticate to resources like Key Vault without storing credentials. Granting each service's managed identity access to Key Vault ensures secure retrieval of secrets and aligns with the principle of least privilege. Other options either rely on shared secrets or do not provide per-service identities.

Answer

Configure the services to use API keys stored in Azure App Configuration and enable Azure AD authentication for the application.

Answer

Use Azure AD service principals with client secrets for each service and store the secrets in Azure Key Vault.

Answer

Store the service keys in Azure Key Vault and configure the application to retrieve them at runtime using the Azure SDK.

Question 2

You are planning to deploy an Azure AI Language resource that will be used by multiple applications. The applications must authenticate using Azure Active Directory (Azure AD) tokens. You need to assign the appropriate role to the applications' managed identities so they can call the Azure AI Language service. Which role should you assign?

Accepted Answer

Cognitive Services User. For applications to call Azure AI Language using Microsoft Entra ID authentication, they need a role that grants data-plane access. The Cognitive Services User role provides read and write access to the service's data plane without granting management permissions. This aligns with least privilege and is the correct choice for managed identities that only need to invoke the API.

Answer

Reader

Answer

Azure AI Developer

Answer

Cognitive Services Contributor

Question 3

You are deploying an Azure AI solution that uses Azure Cognitive Services. You need to ensure that the API keys are stored securely and can be rotated automatically. What should you use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct choice because it provides secure storage for secrets and supports automated rotation. It integrates with other Azure services and allows you to manage keys centrally. The other options do not offer the same level of security and rotation capabilities.

Answer

Azure Storage account with SAS tokens

Answer

Environment variables in Azure App Service

Answer

Azure App Configuration

Question 4

You are building an Azure AI solution that uses Azure AI Vision to analyze images. The solution must be able to extract text from images and return the text in a structured format. You need to choose the appropriate Azure AI Vision feature. What should you use?

Accepted Answer

Read API. The Read API is the OCR component of Azure AI Vision. It extracts text from images and returns it in a structured JSON format with lines and words. This is the correct choice for extracting text from images in a structured format.

Answer

Image Analysis

Answer

Face API

Answer

Custom Vision

Question 5

You are planning to deploy an Azure AI solution that uses Azure Cognitive Services. You need to ensure that the solution can be deployed to multiple regions and that each region uses a separate endpoint. What should you do?

Accepted Answer

Deploy multiple Cognitive Services accounts, one per region, and configure the application to use the appropriate endpoint.. To have separate endpoints per region, you must deploy a Cognitive Services account in each region. Each account provides a unique endpoint and key. This approach also allows for regional failover if needed. The application must be designed to select the correct endpoint based on the region.

Answer

Deploy a single Cognitive Services account and enable the multi-region feature.

Answer

Deploy a single Cognitive Services account and use the same endpoint for all regions.

Answer

Deploy a single Cognitive Services account and use Azure Traffic Manager to route requests to different regions.

Question 6

You are managing an Azure AI services resource that is used by several departments. The security team requires that you monitor the resource for unusual access patterns and receive alerts when the number of failed authentication attempts exceeds a threshold. You need to configure the appropriate Azure Monitor components. Which two actions should you take? (Choose two.)

Accepted Answer

Create an alert rule in Azure Monitor that triggers when the count of failed authentication events in the Log Analytics workspace exceeds a threshold.. To monitor failed authentication attempts, you must first enable diagnostic settings to collect logs into a Log Analytics workspace. Then, you can create an alert rule that queries those logs and triggers when the count of failed authentication events exceeds a threshold. The other options either address network security, provide general threat detection, or use an unrelated metric, so they do not meet the specific monitoring and alerting requirement.

Answer

Enable Azure Defender for AI services to detect anomalies and generate security alerts.

Answer

Create a metric alert on the TotalCalls metric for the Azure AI services resource.

Answer

Configure a private endpoint for the Azure AI services resource to restrict access to a virtual network.

Question 7

You are designing an Azure AI solution that uses multiple Azure AI services, including Azure AI Vision and Azure AI Language. You need to ensure that the solution can be deployed in a way that minimizes latency between services and provides a single endpoint for management. What should you use?

Accepted Answer

Deploy a single Azure AI Services multi-service resource that includes both Vision and Language capabilities.. A multi-service Azure AI Services resource bundles multiple AI capabilities into a single Azure resource with one endpoint and key. Deploying it in one region ensures all services are co-located, reducing latency. It also simplifies management by consolidating billing and access control, meeting both requirements.

Answer

Deploy a single Azure AI Services resource for each service and use private endpoints to connect them.

Answer

Deploy each service as a separate resource in the same region and use Azure API Management to aggregate them.

Answer

Deploy each service as a separate resource in different regions and use Azure Front Door to route requests.

Question 8

You are planning to deploy an Azure AI Services multi-service resource. You need to ensure that the resource can be used by applications running in an Azure Kubernetes Service (AKS) cluster without embedding keys in the application code. What should you do?

Accepted Answer

Configure Azure AD Pod Identity or Workload Identity for the AKS cluster and assign the Cognitive Services User role to the identity on the Azure AI Services resource.. To enable keyless authentication for applications in AKS, you should use Microsoft Entra ID Workload Identity (or Pod Identity) to associate a managed identity with the pods. That identity must be granted the Cognitive Services User role on the Azure AI Services resource. The application can then use DefaultAzureCredential to obtain a token and call the service without any keys.

Answer

Store the Azure AI Services key in a Kubernetes secret and mount it as an environment variable in the application pods.

Answer

Enable a system-assigned managed identity on the AKS cluster and assign the Cognitive Services User role to it on the Azure AI Services resource.

Answer

Use Azure Key Vault to store the Azure AI Services key and retrieve it at runtime by using the AKS cluster's managed identity.

Question 9

You are planning a solution that uses Azure AI Document Intelligence to process invoices. The solution must be deployed to a production environment with high availability. You need to use an Azure Resource Manager (ARM) template to deploy the Document Intelligence resource. The template must ensure that the resource is deployed to two Azure regions. What should you do?

Accepted Answer

Create two separate Document Intelligence resources in the ARM template, each in a different region, and use a Traffic Manager profile to distribute requests.. To achieve high availability across regions for Azure AI Document Intelligence, you must deploy multiple resources, each in a different region. An ARM template can define both resources, and you can use Azure Traffic Manager to route requests. This ensures that if one region fails, the other can handle the load. The other options either do not provide cross-region redundancy or rely on non-existent features.

Answer

Use the copy element in the ARM template to deploy multiple instances of the Document Intelligence resource with the same region but different names.

Answer

Deploy a single Document Intelligence resource and configure geo-replication through the Azure portal after deployment.

Answer

Deploy the ARM template with a single Document Intelligence resource and set the location property to a variable that contains multiple regions.

Question 10

You are planning a new Azure AI solution that will use Azure AI Language, Azure AI Vision, and Azure OpenAI. The security team requires that all service credentials be managed centrally, rotated automatically, and never stored in source code or application configuration files. You need to configure the application to retrieve the endpoint and key for each service at runtime. What should you use?

Accepted Answer

Store the keys in Azure Key Vault and retrieve them at runtime by using the Azure Key Vault SDK with a managed identity.. Central secret management with automatic rotation and credential-free access is provided by Azure Key Vault combined with managed identities. Retrieving secrets at runtime through the Key Vault SDK means no key material is ever written into source code or configuration files. The other options either store secrets in non-secret stores or rely on credentials that themselves must be protected.

Answer

Store the keys in an Azure Storage account table and retrieve them by using a shared access signature.

Answer

Store the keys in environment variables on each Azure App Service instance and read them by using the configuration API.

Answer

Store the keys in an Azure App Configuration store and load them on application startup by using the App Configuration provider.

Question 11

You are deploying an Azure AI solution that uses Azure OpenAI Service and Azure AI Language. The solution must ensure that each service has its own managed identity and that access to keys is restricted. You need to configure authentication for the services. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Resource group. A resource group is the fundamental logical container for Azure resources. By placing all Azure AI services resources in one resource group, you can deploy them together using a template and assign RBAC permissions at the resource group scope, which cascades to all contained resources. This provides both consistent management and centralized access control without granting overly broad permissions.

Answer

Management group

Answer

Azure Resource Manager template

Answer

Azure subscription

Question 12

You are deploying an Azure AI solution that uses Azure OpenAI Service and Azure AI Language. The solution must ensure that each service has its own managed identity and that access to keys is restricted. You need to configure authentication for the services. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Azure AI Search service to use a managed identity and grant it access to the Azure SQL database.. Using a managed identity for the Azure AI Search service and granting it access to the Azure SQL database allows the indexer to authenticate without storing credentials. This is the most secure and recommended approach for service-to-service authentication in Azure.

Answer

Store the Azure SQL database connection string in Azure Key Vault and reference it in the indexer definition.

Answer

Use SQL authentication with a username and password, and encrypt the connection string using Azure AI Search's built-in encryption.

Answer

Configure the Azure SQL database to allow access from all Azure services and use a firewall rule.

Question 13

You are managing an Azure AI solution that uses Azure OpenAI and Azure AI Search. You need to ensure that the solution can be deployed to multiple environments with different configurations while minimizing manual steps. Which two actions should you take? (Choose two.)

Accepted Answer

Store environment-specific values in a parameter file for each environment.. To deploy the same solution to multiple environments with minimal manual steps, you should parameterize environment-specific values using parameter files and modularize the deployment using Bicep modules referenced by environment-specific main files. This combination ensures consistency, reduces duplication, and allows automated, repeatable deployments across development, test, and production.

Answer

Manually create resources in the Azure portal for each environment.

Answer

Use a single hard-coded connection string for all environments.

Answer

Use Azure Policy to enforce naming conventions and tags after deployment.

Question 14

You are deploying an Azure AI solution that uses Azure OpenAI Service and Azure AI Language. The solution must ensure that each service has its own managed identity and that access to keys is restricted. You need to configure authentication for the services. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable a system-assigned managed identity on the container app and assign the Cognitive Services User role to the identity on each Azure AI resource.. Identity-based authentication with a managed identity and the Cognitive Services User role allows the container app to call Azure OpenAI and Azure AI Language without any keys. Because the identity is recognized by Microsoft Entra ID, the calls are authorized even when the services are reachable only through private endpoints. The other options either use keys or assign roles that do not grant data-plane access.

Answer

Create a service principal, store its client secret in the container app environment variables, and assign the Contributor role on each Azure AI resource.

Answer

Use the Azure AI services multi-service account key retrieved from Azure Key Vault and pass it in the Ocp-Apim-Subscription-Key header.

Answer

Configure the container app to use an Azure Front Door origin with a private link and enable token-based authentication by using a shared access signature.

Question 15

You are developing an Azure AI solution that uses Azure Cognitive Search. The solution must index documents from an Azure Blob Storage container. You need to ensure that the indexer can access the Blob Storage container securely without storing credentials in the indexer definition. What should you do?

Accepted Answer

Enable a managed identity for the Azure Cognitive Search service and grant it access to the Blob Storage container.. A managed identity for Azure Cognitive Search is the correct approach because it allows the indexer to authenticate to Blob Storage without storing any credentials in the indexer definition. You assign the managed identity the appropriate role on the storage account. This is a secure, Azure-native method. The other options either store credentials (SAS token or account key) or use the wrong key for authentication.

Answer

Use a shared access signature (SAS) token for the Blob Storage container and include it in the indexer's data source connection string.

Answer

Store the Blob Storage account key in Azure Key Vault and reference it in the indexer definition using a Key Vault secret URI.

Answer

Configure the indexer to use the Azure Cognitive Search service's API key to authenticate to Blob Storage.